Unsecured Backend Access in Mintplex Labs AnyThing-LLM Desktop Application for Windows

CVE-2024-8196

What is CVE-2024-8196?

The AnyThing-LLM desktop application by Mintplex Labs, version 1.5.11, opens server port 3001 on the address 0.0.0.0 without requiring authentication by default. This configuration poses a significant security risk as it allows unauthorized attackers to gain full backend access. With this access, an attacker can execute harmful actions, including the deletion of all data within the workspace. It is advised to implement immediate security measures to restrict access and prevent exploitation.

References